Sensitive Information Exposure in PixelYourSite Plugin for WordPress
CVE-2025-14280

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Pixelyoursite – Your Smart Pixel (tag) & Api Manager
Vendor
CVE Published:
29 December 2025

What is CVE-2025-14280?

The PixelYourSite plugin for WordPress is impacted by a vulnerability that allows unauthenticated users to access sensitive information through publicly exposed log files when the 'Meta API logs' setting is enabled. This security flaw was partially addressed in version 11.1.5 and fully resolved in version 11.1.5.1. Users are recommended to disable the logging feature and update to the latest version to ensure their log files do not reveal sensitive information.

Affected Version(s)

PixelYourSite – Your smart PIXEL (TAG) & API Manager 0 <= 11.1.5

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/pixelyoursite/...
https://plugins.trac.wordpress.org/changeset/3424175/pixe...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcin Dudek
.